CVE-2026-72003 wifi: brcmfmac: cyw: fix heap overflow on a short auth frame
A heap overflow in the Linux kernel brcmfmac Wi-Fi driver allows remote attackers to execute code or cause a denial of service via a short authentication frame.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-72003?
CVE-2026-72003 is a high-severity memory corruption vulnerability in Linux, published on 15 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
wifi: brcmfmac: cyw: fix heap overflow on a short auth frame
brcmf_notify_auth_frame_rx() takes the frame length from the firmware event and copies the frame body with the management header offset subtracted:
u32 mgmt_frame_len = e->datalen - sizeof(struct brcmf_rx_mgmt_data); ... memcpy(&mgmt_frame->u, frame, mgmt_frame_len - offsetof(struct ieee80211_mgmt, u));
The only length check is e->datalen >= sizeof(*rxframe), so mgmt_frame_len can be anything from 0 up. offsetof(struct ieee80211_mgmt, u) is 24. When mgmt_frame_len is below that, the subtraction wraps as an unsigned value to a huge length. The memcpy then runs far past the kzalloc'd buffer. A malicious or malfunctioning AP can make the frame short during the external SAE auth exchange, so this is a remotely triggered heap overflow.
Reject frames shorter than the management header offset before the copy.
Weakness: CWE-191
Which versions are affected by CVE-2026-72003?
How do I fix CVE-2026-72003?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-72003 being exploited?
There is no known exploitation of CVE-2026-72003 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-72003, DEBIAN-CVE-2026-72003, GHSA-chrv-c8hf-p9c7, UBUNTU-CVE-2026-72003.